T09 · Insecure Skill Coding Practices
Error
- Location
skills/chembl-skill/scripts/rest_request.py:63- Finding
Unrestricted HTTP Client Enables SSRF and Arbitrary Data Transmission
- Content
View full analysis
str: if path.startswith(("http://", "https://")): return path return base_url.rstrip("/") + "/" + path.lstrip("/") ``` ```python def parse_input(payload: Any) -> dict[str, Any]: if not isinstance(payload, dict): raise ValueError("Input must be one JSON object.") base_url = _require_str("base_url", payload.get("base_url"), required=True) path = _require_str("path", payload.get("path"), required=True) method = (_require_str("method", payload.get("method")) or "GET").upper() if method not in {"GET", "POST"}: raise ValueError("`method` must be GET or POST.") json_body = payload.get("json_body") form_body = payload.get("form_body") if json_body is not None and form_body is not None: raise ValueError("Provide only one of `json_body` or `form_body`.") response_format = ( _require_str("response_format", payload.get("response_format")) or "auto" ).lower() if response_format not in {"auto", "json", "text"}: r ...[truncated 3943 chars]- Remediation
View remediation